Hi @neilfajardo15, if you have few hosts is possible to insert them in the search, even if I always hint to use the lookup to have a more maintenable object. so, if you have three hosts, you could run something like this: | metasearch index=_internal | eval host=lower(host) | stats count BY host | append [ | makeresults | eval host="host1", count=0 | fields host count ] | append [ | makeresults | eval host="host2", count=0 | fields host count ] | append [ | makeresults | eval host="host3", count=0 | fields host count ] | stats sum(count) AS total By host | where total=0  Ciao. Giuseppe P.S.: next time, please, open a new question. ... View more

Hi, Sorry for the late reply the alert works but it was spamming a lot of mail and also even though the data is flowing it is still alerting  ... View more